Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13/10/2023, 04:28
General
-
Target
5af1318f7ee0b2486abc182278187f47d629db5c3d50fbcae52cf8bd95cbdb52.exe
-
Size
75KB
-
MD5
d786ccfa46c600bad10d33820be873a5
-
SHA1
60fe71133bfdac76c1e4880d84bdcccc13221952
-
SHA256
5af1318f7ee0b2486abc182278187f47d629db5c3d50fbcae52cf8bd95cbdb52
-
SHA512
4144332c7eadf9011397c3ee0a031411b46311473a1c0d60b22ed2f03a30279d6620a77faa28da5f776bc84f699712b0384ce459d8797310d1f7e542518ad8a8
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOpa:RshfSWHHNvoLqNwDDGw02eQmh0HjWOpa
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5af1318f7ee0b2486abc182278187f47d629db5c3d50fbcae52cf8bd95cbdb52.exe"C:\Users\Admin\AppData\Local\Temp\5af1318f7ee0b2486abc182278187f47d629db5c3d50fbcae52cf8bd95cbdb52.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5f7882b14279787f0774fadb27003534f
SHA1cfe7b68c1e581fb08a151ca2b82b45152f01b11b
SHA256a353838e854243e223c7f56f350641f2a2d0ba787dee924d7ca686e92f3ff4ea
SHA5126a1b86b0b5bd5a86e2a0453772d321d45f7ed23e5b55858566fb21ae13bca56372722b62c752b01f5d33c25b154a128bb40aef4a8486581b15fbc470be8e7158
-
Filesize
81KB
MD5dab1eba3f5fde86df5ab27b6025386bc
SHA1643ee0a3e9504431cef525ab8ba46681661a6089
SHA256d7dabc84a5c9fedef26c5fc41058ad6a17f142db7c9708e9f539e1c8d5347b17
SHA5120888614237a366f37c27a075da2ae46278013ae32170cffd61587ac73a285e2ad2172796be111175fc2713028f5a1faac3b0028929594689aa74992a0d60489b
-
Filesize
81KB
MD5dab1eba3f5fde86df5ab27b6025386bc
SHA1643ee0a3e9504431cef525ab8ba46681661a6089
SHA256d7dabc84a5c9fedef26c5fc41058ad6a17f142db7c9708e9f539e1c8d5347b17
SHA5120888614237a366f37c27a075da2ae46278013ae32170cffd61587ac73a285e2ad2172796be111175fc2713028f5a1faac3b0028929594689aa74992a0d60489b
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB